JP3866597B2 - Internal memory tamper resistant processor and secret protection method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention has a large-capacity internal memory capable of storing a plurality of programs and their work areas inside the package, and prevents unauthorized modification of execution code and processing target data in a multitask program execution environment. The present invention relates to a tamper resistant microprocessor.
[0002]
BACKGROUND OF THE INVENTION
Open systems are widely used as information system networks. In the open system, information on computer hardware and system programs (or OSs) for general users such as PCs is disclosed, and the end user can change the system programs and make the desired improvements. In such an environment, in order to protect the copyright of the information handled by the application program and the copyright of the program itself, the secret of the program is premised on the assumption that the OS of the system can take hostile actions on the application. Hardware that protects is needed. An attempt to realize such hardware as a microprocessor has been proposed (Japanese Patent Application No. 2000-35898, Lie et al., “Architectural Support for Copy and Tamper Resistant Software” ,; Computer Architecture News 28 (5) : p168- etc.).
[0003]
These microprocessors have a function of encrypting information in order to prevent peeping and modification of the program and information handled in the multitask environment. Such a microprocessor is called a tamper resistant microprocessor.
[0004]
The main purpose of tamper resistant microprocessors is to protect the rights of rights holders of programs, content and network services through the protection of applications running on end user systems. More specifically, there are the following three.
[0005]
(1) Secret protection of algorithms implemented in programs
(2) Protection of trade secrets and content embedded in the program from confidential or unauthorized copying
(3) Protection from program operation and modification of processing results
Protection of the algorithm implemented in the program is necessary to protect the rights holder of the program, and protection of the trade secret embedded in the program is necessary to prevent unauthorized copying of copyrighted content handled by the program It is. In an application in which a program that uses a network service exchanges billing information with a server, it is important for protecting the rights of the service provider to correctly execute the billing information transmission operation and prevent unauthorized modification. As an actual example, a program for playing a DVD on a personal computer (PC) is analyzed, and a trade secret for decrypting the DVD encryption is read therefrom, and a program for illegally copying the DVD (DeCSS) is created. It is well known.
[0006]
Here, regarding the secret protection mechanism of the application program in the currently proposed open system, the proposals of the present inventors (Japanese Patent Application No. 2000-35898, Japanese Patent Application No. 2000-135010, Japanese Patent Application No. 2000-333635, Japanese Patent Application No. 2001-024480) will be briefly described. In the example to be introduced, programs of a plurality of program vendors are executed on a single system in a pseudo-parallel manner, and each can hold a secret independently from an OS that manages the system resources. Such an environment is referred to as a “multi-party application protection environment”.
[0007]
FIG. 11 shows an overview of a multi-party application protection environment proposed so far. A target system (for example, PC) 1102 incorporates a tamper-resistant microprocessor 1103 and has a secondary storage 1107 such as a hard disk and a memory 1108 outside the processor. A system environment 1101 is configured by the system 1102 and the user 1112.
[0008]
A plurality of different program vendors 1121-1 to 1121-n distribute the encrypted programs 1123-1 to 1123-n to the target system 1102 via the network, respectively. The encrypted program is called a protection program.
[0009]
The encryption program distributed from the vendor is accumulated in the secondary storage 1107 of the target system 1102, and is read into the area 1109 secured on the external memory 1108 at the time of execution. The program is still encrypted on the external memory. The encryption program is not decrypted until it is taken into the microprocessor 1103 from the external memory 1108. The decryption process is performed by the protection function 1106 using the key sent from the vendor corresponding to each program. The decrypted program is read into the cache memory 1104. The decryption of the program and the reading into the cache memory 1104 are not read all at once, but are partially performed according to the execution of the program. The program portion read into the cache memory is in plain text.
[0010]
Inside the microprocessor 1102, the program is handled in plain text by the protection function 1106, and there is no room for the OS 1110 to intervene. Further, the contents of the cache memory 1104 cannot be directly read from the outside except for the operations defined in the specifications of the microprocessor 1103.
[0011]
On the other hand, in recent years, with the development of integrated circuit technology, it has become possible to mount a large-capacity memory in the same package as the microprocessor. In such an internal memory type processor, although there is a limit on the maximum memory capacity, there is a possibility of reducing the encryption processing load at the time of memory reading / writing which has been an overhead in the tamper-resistant processor based on the conventional external memory. There is.
[0012]
However, even if the memory is arranged as an internal memory inside the microprocessor, the resource management of the memory is strictly under the management of the OS, and therefore the hostile operation by the OS can be considered sufficiently. Therefore, in the internal memory type microprocessor, it is necessary to protect the secret of the program under the management of the OS, but no concrete means for realizing the secret protection has been proposed.
[0013]
Furthermore, when an internal memory type microprocessor processes not only a single program but also a plurality of different cryptographic programs in a pseudo-parallel manner, it is necessary to individually guarantee the secret protection of the multiple programs. However, no proposal has been made.
[0014]
[Problems to be solved by the invention]
In order to realize multitask processing while guaranteeing confidentiality protection with an internal memory type tamper resistant microprocessor,
(1) Integrity of memory operations that can protect multiple programs from intentional modification
(2) Compatibility of OS resource management and internal memory secret protection
(3) Communication between task and OS
Need to be considered.
[0015]
Specifically, when a certain task performs n memory operations on an address in the internal memory, it must be protected from memory operations by other tasks and intentional attacks by the OS in the process. . Task execution consists of a number of instruction steps, and the correct result is obtained only when they are executed correctly. When an attacker including an OS executes only a part of a program or excludes only a specific operation from a series of memory operations, the operation of the program is arbitrarily changed, and correct program execution cannot be performed.
[0016]
Also, when operating the memory page as part of resource management by the OS, an attack using memory release can be considered. However, in order to eliminate such an attack, both resource management and program secret protection must be compatible. Don't be.
[0017]
Further, when a system call is issued, the task exchanges data with the OS. At this time, it is necessary to communicate with the OS while sharing the memory.
[0018]
Consider a processor in which the protection mechanism of a conventional external memory type tamper resistant microprocessor is applied to the internal memory type as it is. First, the main internal memory is divided into units called blocks or pages (for example, 4 Kbyte pages). A table is provided in the processor for holding the secret protection attribute for each memory page, and the table entry holds the secret protection attribute of the corresponding memory page. Task T₀ The secret attribute descriptor of the memory page operated by₀ ID is set, and other tasks including the OS cannot read and rewrite the contents in plain text. However, the OS can forcibly release the secret protection attribute of a certain memory page in order to reuse the memory page. When the secret protection attribute of the memory page is canceled, the contents of the page are all erased and initialized to a predetermined value, and the secret of the original task is protected.
[0019]
Task T now₀ Is an address A₀ Memory page M₀ Against M₀  From the initial state of Op₁~ Op_n Suppose n times of memory operations are performed. The initial state may be indefinite, but Op₁~ Op_n The purpose of this is to ensure that the final state is obtained. Naturally, the memory operation by another task should not be added in the process.
[0020]
Memory operations by general tasks can be eliminated by a conventional external memory type protection mechanism. However, OS is page M₀ The attack that rewrites the page to the data intended by the attacker after releasing the secret protection attribute cannot be eliminated or detected even if the external memory type protection mechanism is applied to the internal memory type as it is. Although the secret of the data before the release of the secret protection attribute can be protected, the replacement with other data cannot be prevented.
[0021]
As a result, an attacker with OS privileges can freely rewrite the secret memory contents of the task as intended.
[0022]
Forcibly releasing the secret protection attribute of the memory page is a threat to the secret protection of the task. However, under a multitasking system, such a forced release function cannot be eliminated and only the task itself can release the protection attribute. This is because when an excessive memory is occupied by some tasks, the OS cannot control it.
[0023]
In addition, the unprotected memory access and the protected memory access for communication between the OS and the task must be able to coexist.
[0024]
Therefore, in the present application, with these points in mind, in a microprocessor having a relatively large internal memory in a package, unauthorized modification of executable code or data to be processed is performed under a multitask program execution environment. Realize efficient internal data management that can be prevented.
[0025]
[Means for Solving the Problems]
The internal memory type tamper resistant processor includes:
[0026]
(A) Decryption means for decrypting each of a plurality of programs encrypted with different encryption keys;
(B) an internal memory for storing a plurality of programs decrypted by the decryption means in plain text in units of memory pages;
(C) When the program is read into another memory page of the internal memory and executed as a task, the request secret protection attribute that this task requests for each memory page to be accessed is set exclusively with other tasks. Request secret protection attribute holding unit to be stored;
(D) a memory secret protection attribute holding unit for storing a memory secret protection attribute of the memory page for each memory page;
(E) a secret protection management unit that sets a memory secret protection attribute in a memory secret protection attribute holding unit for a memory page accessed by the task when the task is executed; and
(F) The request secret protection attribute stored in the request secret attribute holding unit is compared with the memory secret protection attribute stored in the memory secret protection attribute holding unit, and if they match, access to the memory page is permitted. Memory protection measure.
[0027]
In such an internal memory type microprocessor, since the program and data are stored in the internal memory in a plain text state, the overhead of processing capacity can be eliminated as much as encryption processing is not required for reading and writing of the memory.
[0028]
Further, even if an OS that manages memory resources intends to perform illegal processing using memory page release under a multitasking environment in which a plurality of programs are run in a pseudo-parallel manner, it does not succeed. This is because access to the memory page is not permitted unless the secret protection attribute requested by the task to the memory page to be accessed matches the secret protection attribute set in the memory area necessary for the task processing.
[0029]
With such a configuration, individual secrets of a plurality of programs are protected, and resource management by the OS and secret protection of each program are compatible. In addition, by managing the secret protection attribute of the memory page, it is possible to secure a non-protected area and guarantee communication between the task and the OS.
[0030]
DETAILED DESCRIPTION OF THE INVENTION
In the following description, a conventional tamper resistant processor that reads and processes a program stored in an encrypted state in a memory outside the microprocessor is referred to as an “external memory type tamper resistant processor”, and the program is stored in the microprocessor package. A tamper resistant processor that stores data in a plain text state is referred to as an “internal memory tamper resistant processor”.
[0031]
Also, in this specification, program confidentiality protection means that the work data of a program encrypted with a unique program key cannot be read from other programs, and data that is intended by the attacker. It also means preventing attacks such as modification of programs and modification of program operations.
[0032]
<First Embodiment>
FIG. 1 is a schematic configuration diagram of an internal memory type tamper resistant processor according to the first embodiment of the present invention. The processor 100 includes a processor core 102, a cache module 103, a bus interface unit (BIU) 107, firmware (ROM) 109 including a privacy manager (secret protection management unit) 301, and an internal memory 110. Which are interconnected via an internal bus 126.
[0033]
The processor core 102 includes a working register 114 used by a program being executed and a task switching unit (STS: secure task switcher) 115. The working register 114 includes a memory type range (MTR) register 401. The MTR register 401 stores a requested secret protection attribute (RPA) that specifies whether or not the task requests secret protection for an internal memory area (that is, a memory page) to be accessed. The task switching unit 115 includes a context table 116 that holds a register state being executed corresponding to a task, and a key table (task key table) 117 that holds key information such as a program encryption key corresponding to a task.
[0034]
Although not shown, the firmware 109 stores a secret key unique to the processor 100. The firmware 109 includes a secret protection management unit 301 called a privacy manager, and manages a memory secret protection attribute (MPA) of each memory page in the internal memory 110. The privacy manager 301 is realized as a program stored in firmware, for example.
[0035]
The internal memory 110 is roughly divided into two areas. A user area 111 and a secret area 112. The user area 111 stores an OS and a user program including the system area at the time of execution. The secret area 112 is an area that can be operated only by the privacy manager 301, and stores a memory secret protection attribute (MPA) table 501. The MPA table 501 stores the secret protection attribute for each memory page. The privacy manager 301 described above sets the memory secret protection attribute in the MPA table 501 for the corresponding memory page in accordance with the secret protection command issued by the task. No operation by the OS is performed in the secret area 112.
[0036]
The cache module 103 includes an instruction cache 104, a data cache 105, and a memory protection module (memory protection means) 106. The data cache 105 reads the page contents of the user area 112 of the internal memory 110 and the secret protection attribute held in the MPA table 501 correspondingly when the program is executed (that is, when the target area is accessed). The memory protection module 106 compares the memory secret protection attribute (MPA) written in the cache tag of the data cache 105 with the task-specified request secret protection attribute (RPA) output from the MTR register 401 of the core 102, and Only when these two attributes match, access to the target memory page is permitted.
[0037]
The BIU 107 has an encryption module (decryption means) 108 and encrypts input / output data with the outside. The processor 100 performs input / output with the outside via the BIU 107. The peripheral device bridge chip 122 connected to the processor via an external bus has a buffer memory 123 therein. The peripheral device bridge chip 122 is connected to the flash memory 121 and the HDD 125, respectively.
[0038]
FIG. 2 shows an internal memory map. The user area 111 and the privacy manager area 301 are isolated on the memory map. The first half of the memory map is assigned to the user area, and the second half is assigned to the privacy manager area. An external program placed in the user area 111 cannot access the firmware area 109 including the privacy manager 301.
[0039]
In the first embodiment, for simplicity of explanation, a real address type processor having no virtual address mechanism is assumed. The operation of such a tamper resistant processor will be described below.
[0040]
Load programs and generate tasks
FIG. 3 is a schematic diagram showing a procedure for reading the program A and generating a task by the microprocessor 100 of FIG. Before being executed by the processor 100, the program A is encrypted and stored in the flash memory 121 (FIG. 1) and the HDD 124 (FIG. 1) outside the microprocessor.
[0041]
Before the program A is read, the task 1 generated by reading the OS or another program is read into the user area 111. The OS is read into an area starting from addresses 0 and P of the user area 111, and the task 1 is read into an area starting from the address X.
[0042]
Program A is composed of a distribution key 302 and a program body 303. When reading the program A, the OS reads the encrypted program A into the buffer memory 123 of the peripheral device bridge chip 122 according to a predetermined procedure. Next, the OS designates the program address in the buffer memory 123, the program placement address Y in the internal memory, and the task ID (task k), and issues a task generation instruction.
[0043]
When a task generation command is issued, control is transferred from the OS to the privacy manager 301. The privacy manager 301 is implemented as a program stored in the firmware 109, for example, and has stronger privileges than the OS that is an external program in order to protect the secret of the program. Only the privacy manager 301 can operate the secret area 112 of the internal memory, the context table 116, and the task key table 117.
[0044]
The privacy manager 301 acquires the distribution key 302 of the program A from the buffer memory 123, decrypts the distribution key 302 via the encryption module 108 using the processor private key (not shown) stored in the firmware 109, and Take out the key. This program key is stored in the entry 117-k corresponding to the task ID (that is, task k) in the task key table 117. Next, the program main body 303 in the buffer memory 123 memory is decrypted via the encryption module 108 using the program key, and the decrypted program is placed in an area starting from the program placement address Y in the internal memory.
[0045]
Further, the task ID (k) is written in the entry corresponding to the program placement area of the memory secret protection attribute (MPA) table 501 (FIG. 1) of the secret area 112, and the protection attribute is given to these areas, so that other tasks Prevent access from. As will be described later, an entry in the MPA table 501 is set for each page of the memory (for example, 4K bytes as one page). Task ID = 1 is written in the entry of task 1 that has been executed so far, and task ID = k is written by reading program A this time.
[0046]
Thus, preparation for task execution is completed, and once control is returned to the OS, the OS issues an instruction to instruct the start of execution of task ID = k. Then, execution of the program A, that is, the task k is started from a predetermined address. In the first embodiment, the privacy manager 301 is realized by the firmware 109, but may be implemented by hardware. In the case of implementation by hardware, the OS can process other tasks in parallel while the privacy manager 301 is preparing for task execution, and the response performance of the system is improved.
[0047]
Secure memory
Now, when executing the generated task k, the task k dynamically secures a necessary memory area in the internal memory 110. First, task k requests a memory area from the OS. The OS allocates a memory area that can be used for task k, for example, a memory area starting from address Z. The task k sets the secret protection attribute of the area in order to use this area as an area that can be exclusively accessed only by the task k. The secret protection attribute is set by task k designating an address area and explicitly issuing a secret protection attribute setting command. Only this task can set the secret protection attribute, and even the OS cannot set the protection attribute of other tasks.
[0048]
Normally, the OS sets a resource protection attribute of the area in a memory management unit MMU (not shown) so as to prevent other tasks from accessing the memory management unit MMU (not shown) in order to avoid contention with other tasks. This setting is only for the purpose of protecting resources by the OS, and it should be noted that the malicious OS does not serve to protect the secret of the task.
[0049]
When a protection attribute setting command is issued from task k, the process proceeds to privacy manager 301. The privacy money 301 writes the ID of the task k, which is the instruction issue source, in the entry corresponding to the designated area of the MPA table 501, and protects this area from access by other tasks. The format of the MPA table 501 is, for example, as shown in FIG. The PAM table 502 has entries 501-1 to 501-n corresponding to each memory page. The entry has two fields, and the field P stores a secret protection bit indicating whether or not the corresponding memory page is protected. For example, when the value of the secret protection bit is 1, it means that there is secret protection. Task IDs are stored in the remaining fields. As described above, when the processor has an MMU (not shown) for resource management, the privacy manager 301 confirms that the task that issued the protection attribute setting instruction has the right to access the target area. It is desirable to adopt a configuration that does this.
[0050]
Memory access by protection task
When a task accesses an address for which a protection attribute is set, the task is accessed by specifying that the target area to be accessed is a protection area. This protection area is designated by an MTR (memory tape range) register 401 in the processor core 102.
[0051]
FIG. 5 shows the format of the MTR register 401. The MTR register 401 is a register composed of two words. The start address of the target area is written in the first word 401 a, the size is written in the second word 401 b, and the secret protection bit 1 is set in the field 402. As a result, a secret protection attribute (RPA) requested by the task is set in the designated address area. When 0 is written in the request secret protection bit, the secret protection attribute set up to that point becomes invalid.
[0052]
Whether a certain memory access is protected or unprotected is determined by the combination of the address range specified by the MTR register 401 and the address to be accessed. If the access target address is within the designated range of the MTR register 401, it becomes a protection target. There may be a plurality of MTR registers that can be used by a task.
[0053]
  FIG. 6 is a flowchart showing a memory access procedure. A memory access procedure will be described. When the core 102 issues a read request to the data cache 105 in order to execute the task, the currently executing task ID and the request secret protection bit requested by the task are output together with the address (S601). On the other hand, when the target area is accessed, the contents are read from the user area 111 of the internal memory 110 into the data cache 105. At this time, the entry corresponding to the memory address is read from the MPA table 501, and the task ID and the memory secret protection bit described in the entry are written to the tag of the corresponding cache line (S602). The acquisition order of the memory secret protection bit and the request secret protection bit is not questioned and may be performed simultaneously.
[0054]
The requested secret protection attribute (RPA) output from the core 102 at the time of memory access is a memory protection attribute that should be set in the memory to be accessed as seen from a certain task. Therefore, this required secret protection attribute (RPA) must match the secret protection attribute (MPA) of the internal memory area to be accessed.
[0055]
  Therefore, in step S603, the memory protection module 106 compares the memory secret protection bit written in the cache tag with the request secret protection bit output from the core 102. If the comparison results match (YES in S603), the process proceeds to step S604, where it is determined whether the task ID written in the cache tag matches the task ID output from the core 102. The determination order of S603 and S604 is not limited and may be simultaneous.
[0056]
Only when both the secret protection bit and the task ID match, the process proceeds to step S605, and it is determined whether or not the task to be executed has the memory page access right. This is because access to the target memory area by a task may be prohibited in the memory management unit MMU due to resource protection by the OS. If the access right is granted (YES in S605), access to the target memory area is permitted, and the memory operation is executed in step S606. If access is prohibited (NO in S606), a resource protection exception occurs in step S608.
[0057]
  On the other hand, if the memory secret protection bit written in the cache tag does not match the secret protection bit output from the core 102 in step S603 (NO in S603), or the task ID does not match in step S604. In this case, the occurrence of a secret protection exception is notified to the processor core 102 in step S607. As a result, the execution of this task is interrupted and cannot be resumed.
[0058]
  For example, when task k tries to access the target area, if the correct protected area is not set in the MTR register 401 and the target area protected by the secret is accessed as having no secret protection, the task Even if the IDs match, the memory protection module 106 determines an access violation. Similarly, when the request protection bit output from the core 102 is trying to access the memory by specifying the secret protection, the memory protection bit written in the cache tag is targeted for the area without the secret protection. Access is not allowed.
[0059]
Such a criterion for determining a secret protection exception and a criterion for determining a resource protection exception are independent of each other's determination result and order.
[0060]
Note that when accessing the unprotected memory by exchanging data with the OS, it is outside the area specified in the MTR register 401, and the secret protection bit of the entry in the MPA table 501 should be 0, so access is natural. success.
[0061]
If another task accesses the memory area of the internal memory allocated for task k, the task ID sent from the core 102 does not match the task ID of the cache tag, so a secret protection exception naturally occurs. Then, the execution of the task with illegal access is interrupted.
[0062]
Although the protection method of the protection program area in the program area was not mentioned, the secret protection attribute is set in the MPA table 501 of the corresponding area when the program is loaded by the task generation instruction, as in the task processing described above. Is realized. In the case of memory access in the program area, the required secret protection attribute RPA is not defined by the MTR register 401, but the task ID being executed is used as it is.
[0063]
Switching tasks
When an interrupt occurs when the memory operation is properly performed and the task k is executed, the information in the working register 114 at that time is the entry of task ID = k in the context table 116 as shown in FIG. Are temporarily saved, and control is transferred to the OS. Only the privacy manager 301 can know the contents of the context table 116, and the OS and other tasks cannot see the contents. Similarly, the MTR register 401 of the core 102 is protected from access by other tasks as register information of the task k because the request protection attribute (RPA) requested by the task k is designated.
[0064]
Memory release by OS
The OS can forcibly release the memory in which the secret protection attribute is set and use it for other purposes. The OS issues a secret protection forced release command specifying the memory area to be released. When the command is issued, the privacy manager 301 rewrites the MPA table 501 of the target area without protection, and at the same time, initializes the corresponding user memory area 111 to a predetermined value and erases the stored information.
[0065]
When the secret protection attribute is rewritten without protection, the OS can use this memory area for other tasks such as allocating the memory area to another task or using the OS itself.
[0066]
With this memory release function, both secret protection and appropriate memory resource management by the OS are achieved.
[0067]
End of task
When the OS ends the task protected by secret, the OS designates this task ID and issues a task end command. When the task end instruction is issued, the privacy manager 301 rewrites the corresponding entry in the MPA table 501 in which the task secret protection attribute is set to a value without protection. At the same time, the memory area is initialized in the same manner as when the memory is released. With this task end function, the task ID can be reused without leaking the secret held by the task.
[0068]
Memory access integrity guarantee effect
It will be described that the memory access protection can be consistently ensured by the configuration of the microprocessor 100 described above.
[0069]
Task T₀ Is an address A₀ Memory page M₀ Against M₀From the initial state of Op₁~ Op_n Suppose n times of memory operations are performed. The initial state may be indefinite, but Op₁~ Op_n It is necessary to obtain the final state result by reliably performing the operation. In the process, memory operation by another task is added, Op₁~ Op_nThe order of operations must not be changed or omitted. Even if the page is initialized once during a series of operations, the result will be different from what is expected.
[0070]
In the method of the first embodiment, first, the task T₀ Is memory page M₀ Is issued and a command to set the secret protection attribute is issued. As a result, the memory page M₀ The secret protection bit “1” and the task ID are set in the entry of the MPA table 501 corresponding to. After that, M is stored in the MTR register 401.₀Set the address of₁~ Op_n Perform the operation. The program itself is encrypted, and it is difficult for an attacker to change the order. The task itself sets the memory page secret protection attribute, sets the MTT register 301, Op₁~ Op_n It is guaranteed that the sequence of operations is correct.
[0071]
Next, memory page M₀ Is referenced by a real address, so it is guaranteed that there is always only one page referenced as an address.
[0072]
Therefore, Op₁~ Op_n If the access succeeds without a secret protection exception, it is true that the target memory page M₀Op to₁~ Op_n It means that the operation was performed.
[0073]
Also, it is the task itself that can set the secret protection attribute for a certain memory page.₁~ Op_n Prior to this operation, the secret protection attribute is set only once. Op to memory page₁~ Op_n Is accessed by designating the secret protection bit 1 in the MTR register 401. If the OS is releasing memory pages during this time, Op₁~ Op_n In this case, the protection attribute (RPA) designated by the MTR register 401 and the protection attribute (MPA) of the memory page do not coincide with each other, a secret protection exception occurs, and the execution of the task should have been stopped there.
[0074]
Therefore, Op₁~ Op_n In this access, the fact that the access was successful without generating a secret protection exception means that the memory has not been released by the OS during these operations.
[0075]
As described above, the configuration of the microprocessor according to the first embodiment can guarantee the integrity and consistency of the memory operation described above. This integration of memory operations is compatible with both forced memory release (resource management) by the OS and access to unprotected memory pages by tasks.
[0076]
This balance between resource management and secret protection is that only the task can set the secret protection attribute of the memory, and when accessing the memory, the memory protection attribute MPA provided in the memory page and the request protection attribute RPA held by the task are set. This is realized as a result of a combination of permitting access only when the attributes match in comparison.
[0077]
However, the configuration in which memory access is permitted only when MPA and RPA match is the same, even when protected memory and non-protected memory access coexist, even if there is no explicit secret protection attribute setting by the task, the memory operation is performed independently. It has the effect of improving the safety of
[0078]
Second Embodiment
In the first embodiment, the setting of the secret protection attribute of the internal memory is performed by an explicit command issued by the task. In the second embodiment, the setting of the secret protection attribute of the memory is implicitly performed by memory access. That is, when a memory page is not protected (that is, the memory protection attribute MPA is 0) and the task accesses the memory in a state where the task requests secret protection (that is, the value of the request protection attribute RPA is 1), Thus, the memory protection bit 1 is set in the field of the corresponding MPA entry. At the same time, the memory contents are initialized with random numbers. With this configuration, the security of the memory contents is further improved.
[0079]
Similar to the first embodiment, except that the secret protection attribute is implicitly set in the target memory area at the time of memory access. The implicit secret protection attribute setting at the time of memory access will be described in detail below.
[0080]
FIG. 7 is a flowchart showing a memory access procedure including implicit secret protection attribute setting. Whether or not a certain memory area is accessed as a protection area is determined by a combination of the address range designation of the MTR register 401 and the target address, as in the first embodiment.
[0081]
First, in step S701, the secret protection bit and the task ID constituting the requested secret protection attribute (RPA) are output from the core 102 together with the target address. On the other hand, in step S702, the MPA protection bit and the task ID of the corresponding memory page stored in the cache tag are acquired by the memory protection module 106.
[0082]
In step S703, it is determined whether the secret protection bits of RPA and MPA match. If they match, it is determined in step S704 that the task IDs match, and the resource protection determination is processed in steps S705, S706, and S711 as in the first embodiment.
[0083]
If they do not match (NO in S703), the process advances to step S707 to determine whether or not the secret protection bit of RPA is 1. If the secret protection bit of the RPA is 1 (YES in S707), the process moves to the privacy manager 301 in step S708, and the value 1 of the secret protection bit and the task ID of the accessed task are stored in the MPA entry of the memory page to be accessed. Is set. In step S709, all the contents of the page are initialized with random numbers. Thereafter, the process proceeds to step S704, where the matching of task IDs is determined, and the subsequent processing is the same as in the first embodiment.
[0084]
When the secret protection bit of RPA is not 1 in step S707 (that is, 0), the access is treated as a secret protection violation, and a secret protection exception occurs in step S710.
[0085]
A supplementary explanation will be given that the memory access of the task is consistently protected from intentional memory modification by the OS by the configuration of the second embodiment.
[0086]
Task T₀ Is an address A₀ Memory page M₀ Against M₀From the initial state of Op₁~ Op_n Suppose n times of memory operations are performed. The initial state may be indefinite, but Op₁~ Op_n It is necessary to obtain the final state result by reliably performing the operation. In the process, memory operation by another task is added, Op₁~ Op_nThe order of operations must not be changed or omitted. Even if the page is initialized once during a series of operations, the result will be different from what you expect.
[0087]
In the method of the second embodiment, task T₀ Memory page M in the MTR register 401₀ Set the address of memory page M₀ Op to₁Issue memory operations for. At that time, memory page M₀ Is set with the memory secret protection attribute. In the initial state, memory page M₀ Should not have been given a protection attribute yet. Task T₀ Then, Op₁~ Op_nI do.
[0088]
First, the program itself is encrypted, and it is difficult for an attacker to change the order. Therefore, the secret protection attribute setting of the memory page, the setting of the MTR register 401, the Op₁~ Op_n It is guaranteed that the sequence of operations is correct.
[0089]
Next, since a memory page is referenced by a real address, there is always only one page referenced by a certain address. Therefore, Op₁~ Op_n If the access succeeds without a secret protection exception, it is true that the target memory page M₀ , Op₁~ Op_n It means that the operation was performed.
[0090]
In addition, only the task can set the secret protection attribute of the task in a certain memory page, and the secret protection attribute is set by this task in Op.₁~ Op_n Limited to the operation. However, in this case, the contents of the memory page are initialized with random numbers.
[0091]
Therefore, during this time, the OS once releases the memory page, and M₀ Even if the contents are rewritten as intended, the protection attribute is cleared in that case. As a result, the contents are always initialized with random numbers, and intentional modification is not successful. Of course, although the normal operation of the task is hindered, it is generally very unlikely that the result will produce the intended result of the attacker.
[0092]
With the configuration of the second embodiment, the secret memory of the task can be protected from intentional modification. Such protection is compatible with forced memory release by the OS and access to unprotected memory pages by tasks.
[0093]
<Third Embodiment>
In the first and second embodiments, the security of task secrets and the memory management by the OS are compatible for the real address type microprocessor, and at the same time, the communication between the task and the OS is ensured and the memory operation is consistent. The secret protection method that guarantees the security is explained.
[0094]
The third embodiment relates to an internal memory type processor having a virtual storage mechanism. In particular, prevention of a memory page replacement attack, which is a problem in a processor having a virtual memory mechanism, will be described.
[0095]
In a system having a virtual storage mechanism, the OS can allocate an arbitrary page of physical memory to an arbitrary virtual address. In addition, this assignment can use a different assignment depending on the task. A table on the internal main memory called a page table is used for the description of allocation. The page table will be described later.
[0096]
In memory access, in order to convert a virtual address into a physical address at high speed, only a necessary part of a page table is often read into a special cache memory. This temporary memory is called a TLB (translation load-aside buffer).
[0097]
There are two types of page table reading into the TLB, one performed by processor hardware and the other by software. The former example is Intel Pentium and the latter is MIPS R3000. Reading into the TLB in the third embodiment is applicable to either case.
[0098]
FIG. 8 shows a TLB configuration in the microprocessor of the third embodiment. The secret protection attribute setting in the third embodiment is an explicit setting by a task as in the first embodiment. Therefore, portions other than the TLB configuration are the same as those shown in FIG.
[0099]
First, the page table 111-1 is set in the user area 111 of the internal memory 110. Further, the entry (see FIG. 4) of the MPA table 501 includes a field for storing the virtual address designated in the memory page in addition to the task ID.
[0100]
Next, the instruction cache 104 has P-TLB (104-1) and R-TLB (104-2), and the data cache 105 similarly has P-TLB (105-1) and R-TLB (105-). 2). R-TLB is a TLB for address translation. On the other hand, the P-TLB stores the memory secret protection attribute, and complements the R-TLB to make the task secret protection more secure. The R-TLB and P-TLB entries exist in a one-to-one correspondence, and processing described later is automatically performed on the P-TLB by writing to the R-TLB. In other words, the update of the P-TLB is indirectly performed in response to the writing of the R-TLB, and only the privacy manager 301 can explicitly operate the P-TLB.
[0101]
In the third embodiment, a virtual address at the time of attribute designation is held as an element of the task secret protection attribute. As described above, similarly to the first embodiment, it is assumed that a virtual address is set when a secret protection attribute setting command is issued by a task. The address specified by the task is used as the virtual address. Here, physical address P₀ Memory page M₀ Is the virtual address V₀ Is mapped to. At this time, the privacy manager 301 writes the protection attribute.
As an entry in the MPA table 501, a memory page M₀ Physical address P₀ The entry corresponding to is selected. The selected MPA entry includes a task ID and a memory page M₀ Virtual address V₀ Is written. Although the virtual address assigned to the physical page may differ depending on the task, in the third embodiment, since protection memory sharing between tasks is not considered, as long as the protection attribute is set in the memory, access of other tasks is There is no problem because it is impossible.
[0102]
FIG. 9 illustrates a memory access procedure in the microprocessor of the third embodiment.
[0103]
In step S801, a certain memory page M₀ Is accessed, prior to reading the data, the virtual address V to be accessed₀An entry corresponding to is obtained. In step S802, the acquired entry is loaded from the page table 111-1 to the R-TLB of the data cache 105, and the virtual address V₀ To physical address P₀Preparation for conversion to is done. Loading to the R-TLB is performed by hardware or software (OS).
[0104]
When the load is performed, the conversion destination physical address P is automatically set in step S803.₀ Is read by the privacy manager 301. In step S804, the virtual address V at the time of setting read from the MPA table 501₀ Are compared with the virtual address of the R-TLM that is the conversion source to determine whether or not they match.
[0105]
If they match (YES in S804), the TLB load is successful. If they do not match (NO in S804), the TLB load fails, and a secret protection exception occurs in step S806.
[0106]
When the TLB is successfully loaded, the task ID of the MPA entry and the presence / absence of secret protection are written in the P-TLB (105-1) of the corresponding data cache. Further, the task ID written in the entry of the corresponding P-TLB (105-1) and the presence or absence of secret protection are written in the tag of the cache line read as a result of the address conversion referring to the R-TLB (105-2). It is. Subsequent processing is the same as that of the first embodiment.
[0107]
In the first embodiment, the memory protection attribute (MPA) held corresponding to the physical memory and the request protection attribute (RPA) requested by the task include the secret protection bit and the task ID, respectively. It was done at the time of memory access request.
[0108]
In the third embodiment, the comparison between the memory protection attribute (MPA) and the request protection attribute (RPA) is performed in a distributed manner at the time of TLB loading performed in units of pages and memory access performed in units of words. Virtual address V requested by task when TLB is loaded₀ And the virtual address at the time of setting the protection attribute held in the MPA table 501 are compared. When accessing the memory, the secret protection bit and the task ID are compared as in the first embodiment.
[0109]
Even in the third embodiment, basically, the request protection attribute RPA generated as a result of task execution is compared with the memory protection attribute MPA describing the protection attribute of the memory that is the target area. Each item is different in that it is dispersed in time and made with different granularities.
[0110]
The configuration of the third embodiment is effective in that the integrity of memory operations can be guaranteed against the following attacks.
[0111]
Memory page M with protection attribute set for a task₀ , M₁ To virtual addresses V₀ , V₁ And then processing Op₁ ~ Op_n Consider the case of implementing. Op₁ ~ Op_nProcess in advance V₀ And V₁ It has been decided in either.
[0112]
However, if you use the virtual memory mechanism, Op₁ ~ Op_n Physical memory page M at any point in the operation of₀ , M₁ The arrangement on the virtual address can be changed. For example, memory page M₁If the operation on the memory is clear, the virtual address of the memory page to be manipulated is replaced, thereby the memory page M₀ Can be cleared. In this case, the processing is different from the intention of the program creator, but such a substitution attack cannot be prevented with the configuration based on only the real address as in the first embodiment.
[0113]
In the third embodiment, the virtual address referred to when the memory secret protection attribute is set is stored as the secret protection attribute definition of the physical memory page, and the virtual address to be converted and the stored address are stored when executing the address conversion. Compare. The memory page relocation attack described above is prevented by prohibiting access when a mismatch occurs. In the third embodiment, the processing efficiency is improved by performing the comparison process when the TLB is loaded. However, the comparison may be performed each time the memory is referred to by the processor core. In this case, although the efficiency is somewhat reduced, the same effect can be obtained.
[0114]
In the above example, the guarantee of memory access integrity when using a virtual memory is described in combination with a configuration in which a task explicitly issues a memory secret protection attribute setting command. However, it is added that the virtual address comparison process itself is effective for preventing a memory exchange attack using virtual memory even when used alone.
[0115]
Also, when issuing a secret protection attribute command, it is desirable to once flush the P-TLB that defines the conversion of the corresponding physical address. This is because inconvenience arises when the TLB entry read before issuing the secret protection attribute command remains. For example, if a task references a cache line that has been read as a result of referring to an unprotected TLB entry, the secret protection attribute is not set contrary to expectation, and a secret protection exception occurs and processing is aborted. . Therefore, it is desirable to flush the P-TLB when issuing a secret protection attribute command.
[0116]
<Fourth embodiment>
In the first to third embodiments, the configuration for realizing exclusive memory access by a task in the internal memory type tamper resistant processor has been described.
[0117]
In the fourth embodiment, a configuration example in which a plurality of tasks sharing a secret can share a certain memory area and allows exclusive access to a task that does not hold a secret will be described.
[0118]
Also in the fourth embodiment, the basic configuration is the same as the configuration of the first embodiment shown in FIG. Therefore, the following description will focus on the changes.
[0119]
First, secret protection information for a task to access a shared area of the internal memory is held in the MTR register 401. In the first and second embodiments, only the address area is held in the MTR register 401. In the fourth embodiment, in addition to the address area, a secret value for sharing is held. The secret value is specified by the task when setting the secret protection attribute. This secret value is used as a requested secret protection attribute (RPA) when referring to the memory. The length of the secret value is desirably 128 bits or more in order to prevent brute force attacks.
[0120]
This secret value is also specified when the secret protection attribute is set in the memory page by the task, and is stored in the corresponding entry of the MPA table 501. Therefore, in the fourth embodiment, the items stored in the entry of the MPA table 501 are the four items of presence / absence of protection, task ID, virtual address, and secret value.
[0121]
When the memory protection attribute (MPA) of the program area is set when the program is loaded, the value of the program key that encrypted the program is written in the secret value of the MPA entry.
[0122]
FIG. 10 shows a memory access procedure in the microprocessor of the fourth embodiment.
[0123]
As in the first to third embodiments described above, whether or not access is possible depends on a match between the requested secret protection attribute (RPA) output from the processor core 102 and the memory secret protection attribute (MPA) stored in the cache tag. Determined.
[0124]
That is, in step S901, a secret protection bit indicating task protection, a task ID, a virtual address, and a secret value are obtained from the core. In step S902, the memory protection bit, task ID, virtual address, A secret value is obtained. Of the four items output from the core, three items excluding the task ID are used as the request secret protection attribute (RPA). This is because the memory is shared between the tasks, and the determination criterion is not dependent on the task ID, and the secret value is matched.
[0125]
In step S903, the memory protection module 106 compares the RPA secret protection bit output from the core with the MPA secret protection bit written in the cache tag. If they do not match, a secret protection exception occurs in step S908 as in the first to third embodiments.
[0126]
If the secret protection bits of both match at step S903, the virtual addresses of both (RPA and MPA) are compared with the secret value at steps S904 and S905, respectively. If they do not match, a secret protection exception occurs in step S908.
[0127]
If the secret protection bit, virtual address, and secret value all match in terms of secret protection (YES in S903 to S905), the process proceeds to step S906 to determine whether the task IDs match in terms of resource protection. . If they do not match, a resource protection exception occurs in step S909. If they match, a memory operation is executed in step S907.
[0128]
As a specific usage mode of the microprocessor of the fourth embodiment, for example, a common secret X is embedded in advance in a plurality of programs, and a task A generated from a certain program secures a shared memory area and a secret value An example is given in which X is set and another task B accesses the MTR register 401 by setting the secret value X. The secret value X may be shared by a well-known key sharing method such as Diffy-Hellman method other than a predetermined value.
[0129]
As described with reference to the flowchart of FIG. 10, access to this memory shared area by a task that does not know the secret value X results in a secret protection exception and naturally fails. Therefore, exclusive memory sharing of only tasks that know the secret value X can be realized.
[0130]
In the fourth embodiment, the exclusive (safe) sharing of the memory area has been described in combination with the setting instruction of the memory secret protection attribute by the task. However, the method of securely sharing the memory area by using the secret value for MPA and RPA does not depend on the presence of a secret protection attribute setting command issued by the task, and is a safe memory between tasks alone. Note that sharing is possible.
[0131]
【The invention's effect】
As described above, in an internal memory type microprocessor, in a multitasking environment, the OS manages both internal memory resource management and secret protection, and secures communication between the OS and the task while intending multiple programs. Protection from mechanical modification.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of an internal memory tamper resistant processor according to a first embodiment of the present invention.
FIG. 2 is a diagram of an internal memory map in the tamper resistant processor of FIG. 1;
3 is a diagram for explaining task start and memory allocation in the tamper resistant processor of FIG. 1; FIG.
4 is a diagram showing a configuration example of an MPA table in the tamper resistant processor of FIG. 1. FIG.
FIG. 5 is a diagram illustrating a configuration example of an MTR register in the tamper resistant processor of FIG. 1;
6 is a flowchart showing a memory access procedure of the tamper resistant processor of FIG. 1;
FIG. 7 is a flowchart showing a memory access procedure according to the second embodiment of the present invention.
FIG. 8 is a schematic configuration diagram of a secret protection mechanism of a tamper resistant processor according to a third embodiment of the present invention.
FIG. 9 is a flowchart illustrating a memory access procedure of the tamper resistant processor according to the third embodiment.
FIG. 10 is a flowchart showing a memory access procedure in the tamper resistant processor according to the fourth embodiment of the present invention.
FIG. 11 is a schematic diagram illustrating a typical multi-party application protection environment.
[Explanation of symbols]
100 Internal memory tamper resistant processor
101 processor package
102 processor core
103 Cache module
104 Instruction cache
105 Data cache
104-1 and 105-1 P-TLB
104-2, 105-2 R-TLB
106 Memory protection module (memory protection means)
107 Bus interface unit
108 Cryptographic module (decryption means)
109 Firmware
110 Internal memory
111 User area
111-1 Page table
112 Secret area
114 Working register
116 Task context table
117 Task key table
301 Privacy Manager (Secret Protection Management Department)
401 MTR register (request secret protection attribute holding unit)
501 MPA table (memory secret protection attribute holding unit)

Claims (6)

Decryption means for decrypting each of a plurality of programs encrypted with different encryption keys;
An internal memory for storing a plurality of programs decrypted by the decrypting means in plaintext in units of memory pages;
When the program is read into another memory page of the internal memory and executed as a task, the request secret protection attribute that the task requests for each memory page to be accessed is set exclusively with the other task. A request secret protection attribute holding unit to store;
For each memory page, a memory secret protection attribute holding unit that stores a memory secret protection attribute of the memory page;
A secret protection management unit that sets the memory secret protection attribute in the memory secret protection attribute holding unit for the memory page to be accessed by the task when the task is executed;
The request secret protection attribute stored in the request secret attribute holding unit is compared with the memory secret protection attribute stored in the memory secret protection attribute holding unit, and if they match, access to the memory page is permitted. and memory protection means that,
Address conversion means for converting a virtual address of the internal memory into a physical address, and the memory secret protection attribute holding unit stores the memory secret protection attribute for each physical address of the memory page; The memory secret protection attribute holding unit and the request secret protection attribute holding unit each further store a virtual address of a memory page to be accessed, and the memory protection unit converts the virtual address into the physical address, An internal memory type tamper resistant microprocessor characterized in that a virtual address of the memory secret protection attribute holding unit and a virtual address of the requested secret protection attribute holding unit are compared and address conversion is performed when they match . The memory secret protection attribute protection unit and the request secret protection attribute protection unit further store a task identifier for identifying the task,
The memory protection means compares the requested secret protection attribute with the memory secret protection attribute, compares the corresponding task identifiers with each other, and the requested secret protection attribute and the memory secret protection attribute coincide with each other. 2. The internal memory type tamper resistant microprocessor according to claim 1, wherein access to the memory page is permitted only when the task identifiers match.   2. The internal memory type tamper resistance according to claim 1, wherein the secret protection management unit sets the memory secret protection attribute in the memory secret protection attribute holding unit based on an instruction issued by the task. Microprocessor.   2. The internal memory according to claim 1, wherein the secret protection management unit sets the memory secret protection attribute based on the comparison result when the task accesses the memory page to be accessed. Type tamper resistant microprocessor.   The secret protection management unit requests the secret protection attribute requested for each memory page to be accessed by the task to request secret protection, and the memory secret protection attribute of the memory page to be accessed is an attribute of non-secret protection. 5. The internal memory type tamper resistant microprocessor according to claim 4, wherein if there is, the memory secret protection attribute is set as a secret protection attribute and the memory page is initialized. The internal memory has a shared area shared by a plurality of tasks,
The memory secret protection attribute and the requested secret protection attribute each include a secret value for the sharing;
The memory protection means compares the secret value included in the memory secret protection attribute with the secret value included in the requested secret protection attribute, and permits access to the shared area only when they match. The internal memory type tamper resistant microprocessor according to claim 1.

Images